diff --git a/0014-Fedora-protobuf-is-2.28.patch b/0014-Fedora-protobuf-is-2.28.patch
new file mode 100644
index 0000000..36adfe5
--- /dev/null
+++ b/0014-Fedora-protobuf-is-2.28.patch
@@ -0,0 +1,27 @@
+From 1939eea90812bce32f9e8e61bd5be7330f57fda4 Mon Sep 17 00:00:00 2001
+From: Uri Lublin <uril@redhat.com>
+Date: Fri, 7 Feb 2025 01:14:00 +0200
+Subject: [PATCH] Fedora: protobuf is 2.28
+Content-type: text/plain
+
+Signed-off-by: Uri Lublin <uril@redhat.com>
+---
+ Cargo.toml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Cargo.toml b/Cargo.toml
+index 100adc7..31d4ab9 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -29,7 +29,7 @@ log = "0.4.22"
+ nix = "0.29"
+ openssl = "0.10"
+ prost = "0.13"
+-protobuf = "3.5.1"
++protobuf = "2.28"
+ rand = "0.8.5"
+ reqwest = { version = "0.12", default-features = false }
+ resource_uri = { path = "attestation-agent/deps/resource_uri" }
+-- 
+2.48.1
+
diff --git a/sources b/sources
index 4016e79..3e22340 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
+SHA512 (trustee-guest-components-0.10.0_124.git0061d03-vendor.tar.xz) = 4356221c883760a7af5ef4a80f218a9772336583d1c76188e699772f6a714ee1e95b866fb3dbc58ab205abe074df2f45c0dd229de73da9d9a4ebdb08d5daf621
 SHA512 (guest-components-0061d03.tar.gz) = 1003767c3ca23de625f02f883373ccc3d23a950c2fa9c02a38bc22293be04d298cd6b18ad64d8506eb5060de10e6fa00f6d7197d314d2b75cadea8223202a954
-SHA512 (trustee-guest-components-0.10.0_124.git0061d03-vendor.tar.xz) = e7c8470673b755daf4e78536fe1bb0f0b7749792bf47414940e1e0c44fc70922b0536562a12093d40c099c930412b846ba06c50a772a627f657e0a479b600a83
diff --git a/trustee-guest-components.spec b/trustee-guest-components.spec
index 99786eb..fab3b0e 100644
--- a/trustee-guest-components.spec
+++ b/trustee-guest-components.spec
@@ -9,10 +9,11 @@
 
 Name:           trustee-guest-components
 Version:        0.10.0^%{numcommits}.git%{shortcommit}                
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Tools that run in confidential VMs, attest and get secrets from Trustee
 
 # License lines copied from the build
+# (MIT OR Apache-2.0) AND Unicode-DFS-2016
 # Apache-2.0
 # Apache-2.0 OR BSL-1.0
 # Apache-2.0 OR ISC OR MIT
@@ -23,7 +24,6 @@ Summary:        Tools that run in confidential VMs, attest and get secrets from
 # MIT OR Apache-2.0
 # MIT OR Apache-2.0 OR Zlib
 # MPL-2.0
-# Unicode-3.0
 # Unlicense OR MIT
 # Zlib OR Apache-2.0 OR MIT
 
@@ -40,15 +40,25 @@ Summary:        Tools that run in confidential VMs, attest and get secrets from
 # MIT
 # MIT OR Unlicense
 # MPL-2.0
-# Unicode-3.0
+# (Apache-2.0 OR MIT) AND Unicode-DFS-2016
 
 
-License:        Apache-2.0 AND (Apache-2.0 OR BSD-2-Clause OR MIT) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND ISC AND MIT AND (MIT OR Unlicense) AND MPL-2.0 AND Unicode-3.0
+License:        Apache-2.0 AND (Apache-2.0 OR BSD-2-Clause OR MIT) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND ISC AND MIT AND (MIT OR Unlicense) AND MPL-2.0 AND Unicode-DFS-2016
 
 # LICENSE.dependencies contains a full license breakdown
 
 URL:            https://github.com/confidential-containers/guest-components
 Source:         https://github.com/confidential-containers/%{projectname}/archive/%{commit}/%{projectname}-%{shortcommit}.tar.gz
+
+
+# Creating vendor tar (on latest Fedora):
+# dnf install <all dependencies>
+# rpm -E '% { cargo_prep}' > cargo_prep.sh
+# bash cargo_prep.sh
+# cargo vendor --offline --respect-source-config
+# tar cf vendor.tar vendor/
+# xz --best vendor.tar.xz
+# mv vendor.tar.xz <dir>/<vendor-tarball-long-name>
 Source1:        %{name}-0.10.0_%{numcommits}.git%{shortcommit}-vendor.tar.xz
 # * adapt to RHEL
 # * Remove workspace members which are not built
@@ -77,6 +87,8 @@ Patch11:        0011-Fedora-kbs-types-0.8.0.patch
 Patch12:        0012-Fedora-kbs_protocol-Cargo.toml-add-package.license.patch
 # * url version is 2.5.2
 Patch13:        0013-Fedora-url-version-is-2.5.2.patch
+# * protobuf is 2.28
+Patch14:        0014-Fedora-protobuf-is-2.28.patch
 
 ExclusiveArch:  x86_64
 BuildRequires:  rust-toolset
@@ -134,6 +146,10 @@ cd attestation-agent/kbs_protocol
 %{_bindir}/trustee-attester
 
 %changelog
+* Thu Feb 06 2025 Uri Lublin <uril@redhat.com> - 0.10.0^124.git0061d03-2
+- A smaller vendor Source1
+  Resolves: RHEL-73770
+
 * Tue Jan 21 2025 Uri Lublin <uril@redhat.com> 0.10.0^124.git0061d03-1
 - Initial commit on c10s
   Resolves: RHEL-73770